Control plane and data plane. Computing systems now. Glacial process of innovation made worse by standards process. Computing systems once upon a time

Transcription

1 Classical work Architecture A A A Intro to SDN A A Oerating A Secialized Packet A A Oerating Secialized Packet A A A Oerating A Secialized Packet A A Oerating A Secialized Packet Oerating Secialized Packet A A Oerating We have lost our way A Secialized Packet Routing, management, mobility management, access control, VPNs, Million of 5400 RFCs Barrier to entry lines of source code 500M gates 10Gbytes RAM Bloated Power Hungry Many comlex functions baked into the infrastructure OSPF, BGP, multicast, differentiated services, Traffic Engineering, NAT, firewalls, MPLS, redundant layers, An industry with a mainframe-mentality A A A Oerating Secialized Packet Reality A A A Oerating Secialized ized Packet Lack of cometition means glacial innovation Closed architecture means blurry, closed interfaces Vertically integrated, comlex, closed, rorietary Not suitable for exerimental ideas Not good for network owners & users Not good for researchers

2 Glacial rocess of innovation made worse by standards rocess Idea Standardize Wait 10 years Driven by vendors Consumers largely locked out Lowest common denominator features Glacial innovation Deloyment Wait x years Comuting systems once uon a time Vertically integrated systems Prorietary hardware Prorietary OS Prorietary alications Highly reliable Can you icture google, yahoo, facebook on such a latform? Slow software innovation Prorietary develoment Small industry Comuting systems now Control lane and data lane A A A A A A A A A A A Windows (OS) Oen Interface or Linux Oen Interface Microrocessor or Mac OS Microrocessor Oen interfaces Fast innovation o Everyone can articiate Hugh industry Software is now art of everything. Control lane of a network The functions of a network that control the behavior of the network E.g.: Which ath to take for a acket? Which ort to forward a acket? Should the acket be droed? Control lane functions are tyically realized by software such as routing rotocols, firewall code, etc. Data lane of a network The functions of a network that actually forward or dro ackets. Data lane functions are tyically realized by hardware Control lane and data lane are vertically integrated in traditional networking equiment Searating software from hardware searating control lane from data lane.

3 Conventional networking system today (before SDN) Ideal networking system for innovation Custom hardware OS Bundled alications Mainframe mindset: software for the control lane cannot be searated from the forwarding hardware in the data lane. o Vertically integrated, comlex, closed, rorietary o Innovation is only ossible if one has access to the router box. No significant innovation in the ast 40 years. A A A A A A A A A A A Windows or Oen Interface Linux or Oen Interface Mac OS work as API of OS work Oerating s API for controlling work hardware work hardware Ideal networking system for innovation SDN now: searate forwarding hardware from controlling software A A A A A A A A A A A Windows or Oen Interface Linux or Oen Interface Mac OS Searate hardware from software Standardize the interface Each layer rovides an abstraction Innovation is ossible for anyone just like software develoment for a comuting system. This is the vision of SDN/OenFlow. A A A A A A A A A A A Windows or Oen Interface Linux or Oen Interface Mac OS 4. Firewall, virtual network, TE, etc Northbound API, not standardized yet 3. SDN controllers (floodlight, nox, etc) 1. OenFlow: standardized for ernet// 2. OenFlow enabled switches/routers simle hardware doing forwarding only forwarding table can be set by other entity through OenFlow

4 A Classical work Architecture The Software-defined work A A A work Oerating A A A A A A A Oerating A Secialized Packet A A Oerating Secialized Packet A A A Oerating A Secialized Packet A A Oerating A Secialized Packet A A Oerating A Secialized Packet A A Oerating Secialized Packet A A A Oerating A Secialized Packet A A Oerating A Secialized Packet Oerating Secialized Packet Oerating Secialized Packet The Software-defined work 3. Well-defined oen API 2. At least one good oerating syst Extensible, ossibly oen-sourc A A A Software-Defined work with key Abstractions in the Control Plane work Oerating Simle Packet 1. Oen interface to hardware Simle Packet Simle Packet Simle Packet Simle Packet

5 Isolated slices A A work Oerating 1 A A work Oerating 2 A A work Oerating 3 A Oen interface to hardware Virtualization or Slicing Layer Simle Packet Simle Packet Many oerating systems, or Many versions A work Oerating 4 Oen interface to hardware Simle Packet Simle Packet What and Why software defined? Software defined becomes very oular words Software defined networking, software defined storage, software defined radio, etc. What is it? Underlying system feature is exosed to the uer layer alication develoer through an API. functionality is imlemented over the API as an a. Another word for Software defined is Programmable. Simle Packet What is software defined networking? Abstraction Software-defined networking (SDN) is an aroach to comuter networking that allows network administrators to manage network services through abstraction of lower-level functionality. Abstractions for three roblems: Constrained forwarding model, distributed state, detailed configuration SDN is Directly rogrammable: network control is rogrammable because it is decouled from forwarding functions Agile: administrator can dynamically adjust network-wide traffic flow to meet changing needs. Centrally managed: network intelligence is logically centralized. Programmatically configured Oen standards-based and vendor-neutral Purose: Abstract away forwarding hardware Flexible Behavior secified by control lane Built from basic set of forwarding rimitives Minimal Streamlined for seed and low-ower Control rogram not vendor-secific OenFlow is an examle of such an abstraction

6 State Distribution Abstraction Configuration abstraction Shield control mechanisms from state distribution while allowing access to the state Slit global consensus-based distributed algorithms into two indeendent comonents: a distributed (database) system and a centralized algorithm. We know how to deal with both. Natural abstraction: global network view Imlemented with a network oerating system. Control (configuration) mechanism is now abstracted as a function of the global view using API Control is now based on a centralized grah algorithm instead of a distributed rotocol. Alication should not configure each individual network device. The NOS rovide consistent global view of the network Configuration is a function of the global view NOS eases the imlementation of functionality Does not hel secification of functionality Need a secification abstraction Consequences Contrast between SDN and conventional network More innovation in network services Owners, oerators, 3 rd arty develoers, researchers can imrove the network E.g. energy management, data center management, olicy routing, access control, denial of service, mobility Lower barrier to entry for cometition Healthier market lace, new layers SDN Controller may not be in the same box as the forwarding hardware Centralized routing algorithm with logically global view work functions are realized with a global view New abstraction must be develoed for the centralized view Conventional hardware and its control are in the same box Distributed routing algorithm work functions must be realized in a distributed manner, error-rone work abstraction is embedded in the distributed algorithms

7 Traditional network node: Router Router can be artitioned into control and data lane Management lane/ configuration Control lane / Decision: OSPF (Oen Shortest Path First) Data lane / Traditional network node: Tyical working Software Management lane Control Plane The brain/decision maker Data Plane Packet forwarder Control Program OenFlow Basics Control rogram oerates on view of network Inut: global network view (grah/database) Outut: configuration of each network device Control rogram is not a distributed system Abstraction hides details of distributed state Control Program A Control Program B work OS OenFlow Protocol ernet Control Path OenFlow Data Path ()

8 OenFlow: a ragmatic comromise OenFlow Basics + Seed, scale, fidelity of vendor hardware + Flexibility and control of software and simulation Vendors don t need to exose imlementation Leverages hardware inside most switches today (ACL tables) Control Program A Control Program B work OS If header =, send to ort 4 Packet If header =q, overwrite header with r, add header s, and send to orts 5,6 If header =?, send to me Flow Packet Table( s) Packet Primitives <Match, > Flow Table Flow table in switches, routers, and chisets Match arbitrary bits in headers: Header Match: 1000x01xx x Data Flow 1. Flow 2. Rule (exact & wildcard) Rule (exact & wildcard) Statistics Statistics Match on any header, or new header Allows any flow granularity Forward to ort(s), dro, send to controller Overwrite header with mask, ush or o Forward at secific bit-rate Flow 3. Flow N. Rule (exact & wildcard) Rule (exact & wildcard) Default Statistics Statistics 31

9 Flow Entry A flow entry consists of In Match fields Match against ackets Modify the action set or ieline rocessing Stats Match Udate the matching ackets Fields Stats Tye 1. Forward acket to ort(s) 2. Encasulate and forward to controller 3. Dro acket 4. Send to normal rocessing ieline Vlan Id Tos Proto Layer 2 Layer 3 Layer 4 1. Packet 2. Byte counters OenFlow Controller OenFlow Protocol (SSL/) Control Path OenFlow Data Path () Oen Flow Protocol Messages Controller-to-switch: from the controller to manage or insect the switch state Features, config, modify state, read state, acket-out, etc Asynchronous: send from switch without controller soliciting Packet-in, flow removed/exired, ort status, error, etc Symmetric: symmetric messages without solicitation in either direction Hello, Echo, etc. Oenflow An Oenflow switch (ernet switch) has an internal flow table. If a acket matches an entry in the flow table, erform the actions (e.g. forward to ort 10) according to the flow table. If a acket does not match any entry in the flow table. Send it to the Oenflow controller The controller will figure out what to do with such acket The controller will then resond to the switch, informing how to handle such a acket so that the switch would know how to deal with such ackets next time. For each flow, ideally the controller will be queried once. Oenflow defines the standard interface to add and remove flow entries in the table.

10 OenFlow Examle Controller Flow switching and routing Software Layer OenFlow Client PC Layer 4 Layer Flow Table sort dort * * * * * ort 1 ort 1 ort 2 ort 3 ort 4 Each individual field + meta data Wild Card aggregation E.g. -subnet: */ OenFlow Basics Flow Table Entries Rule Stats Packet + byte counters 1. Forward acket to zero or more orts 2. Encasulate and forward to controller 3. Send to normal rocessing ieline 4. Modify Fields 5. Any extensions you add! ing * tye Examles ID Prot sort dort * 00:1f:.. * * * * * * * ort6 Flow ing ort3 Firewall tye ID Prot sort dort 00: :1f vlan ort6 ID c tye ToS Prot L4 sort L4 dort tye ID Prot sort dort + mask what fields to match * * * * * * * * * 22 dro 40

11 Routing * tye Examles ID Prot sort dort * * * * * * * * ort6 ing * tye ID Prot sort * 00:1f.. * vlan1 * * * * * dort ort6, ort7, ort9 Centralized vs Distributed Control Both models are ossible with OenFlow Centralized Control OenFlow OenFlow Controller Distributed Control Controller OenFlow OenFlow Controller Controller OenFlow OenFlow 41 Flow Routing vs. Aggregation Both models are ossible with OenFlow Reactive vs. Proactive (re-oulated) Both models are ossible with OenFlow Flow-Based Aggregated Reactive Proactive Every flow is individually set u by controller Exact-match flow entries Flow table contains one entry er flow Good for fine grain control, e.g. camus networks One flow entry covers large grous of flows Wildcard flow entries Flow table contains one entry er category of flows Good for large number of flows, e.g. backbone First acket of flow triggers controller to insert flow entries Efficient use of flow table Every flow incurs small additional flow setu time If control connection lost, switch has limited utility Controller re-oulates flow table in switch Zero additional flow setu time Loss of control connection does not disrut traffic Essentially requires aggregated (wildcard) rules

12 Going further Oenflow is imlemented in Mini (mininet.org) Related resources Oen working Foundation: htts:// This lecture materials are based on various resources in the net, in articular this file htts:// df And book Software Defined works A Comrehensive Aroach by Paul Goransson and Chuck Black